The new Data Protection Law introduces important amendments to the regulation of the data subjects’ consent as legal basis.
Current regulatory context v/s Data Protection Bill
Law 19,628 regulates consent and indicates certain requirements regarding it. The new Law comes to change this legal basis considerably:
| Law 19,628 | Data Protection Bill |
|---|---|
| Consent must be express, written and duly informed about the purposes of the processing. | Consent must be free, informed and specific as to the purpose of the processing, granted in advance and unequivocal, and expressed by means of an oral, written or equivalent electronic statement or an affirmative act. Consent is presumed not to be freely given when the data controller obtains it in the context of the execution of a contract or the provision of a service for which the authorized data processing is not required. However, this presumption does not apply when consent is required as the sole consideration in exchange for goods, services or benefits. |
What is the consent in matters of personal data protection?
Consent –in the context of data protection– is a legal basis that authorizes to perform certain data processing. This authorization is granted by the data subject to the data controller.
In the new Law, consent is defined as “any free, specific, unequivocal and informed manifestation of will, granted through a statement or a clear affirmative action, by which the data subject, her/his legal representative or agent, as applicable, authorizes the processing of personal data pertaining to her/him”.
General rule of data processing
The new Law states that, as a general rule, the processing of data that has the consent of the data subject will be lawful, to the extent that it complies with the requirements set forth by law, that is: free, informed and specific as to its purpose/s, and also granted in advance and unequivocally, by means of an oral, written statement or expressed through an equivalent electronic means, or by an affirmative act that clearly evidences the data subject’s will.
When the consent is granted by a representative, she/he must be expressly empowered with this authority.
Revocation of consent
The data subject may revoke the consent granted at any time and without cause, using similar or equivalent means to those used for its granting. The revocation of consent will not have retroactive effect. The means used for the granting or revocation of consent must be prompt, reliable, free of charge and permanently available to the data subject.
Presumption of consent not freely given
It is presumed that consent to process data has not been freely given when the data controller obtains it for the execution of a contract or the provision of a service for which the authorized data processing is not necessary. The new Law states that this presumption will not apply when the person offering goods, services or benefits requires the consent to process data as the only consideration.
Evidence of informed consent
It is up to the data controller to evidence that it had the consent of the data subject, and that the data processing was carried out in a lawful, fair and transparent manner.